Subject: Re: PSA: salonb.bat snapshots a list of files on a PC (e.g., additions/removals & when)

On Thu, 9/3/2026 10:47 PM, Maria Sophia wrote:

PSA: salonb.bat snapshots a list of files on a PC (e.g., additions/removals & when)
intended for further post processing (perhaps using MS CoreUtils)

A file's timestamp tells us something useful about the file.
A historical inventory tells us something useful about the computer.

When you do this, you should preface your remarks, with
what part of the C: drive can be reliably processed this way.
Is it your Downloads folder ? Is it your Profile tree ?
Is it the entire C: drive ?

Well, we know it isn't the entire C: drive.

You stand a better chance of listing the D: "Data" drive, as it
has fewer curve balls inside it.

The USN Journal broadcasts, are how the Search Indexer keeps track
of ongoing changes. The Search Indexer is not "watching" that
/bin/rm -Rf script you just started executing, it does not "watch"
the primary sources of damage. It watches the Journal, and the Journal
reports 3000 events for the 3000 files you just deleted. The
Search Indexer then removes those 3000 items, from the inverted index.

The Voidtools Everything.exe utility, after having made an initial
list of the C: drive, it listens to the USN Journal broadcasts for
updates to its list. If a new file is Created, then Everything.exe
adds that file to its list. That's how Everything.exe remains <cough> "accurate" for NTFS, all day long. If you were monitoring a FAT32
volume, then the "quality" of the file list is considerably
poorer for it.

When comparing various tools that list the contents of C: ,
the number of files in the difference has been as high as 100,000 files.
That is how many files one of the listing methods, missed.
And that's one of the challenges of "just diffing stuff".

Paul


--- PyGate Linux v1.5.19
* Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)